Inquiring minds want to know. They’ll be disappointed.
You cannot.
Once your computer has been hacked, it’s not your computer anymore.
That sounds serious because it is.
After a hack
- You cannot tell with certainty what a hack or malware may have affected.
- The most common approach is to run repeated anti-malware scans.
- The best solution is to revert to an image backup taken before the hack.
- The painful solution is to reinstall and start over.
Hack fallout
Once your computer has been hacked, there is no approach that will tell you with 100% certainty what the hacker (or malware) changed.
Assuming a sufficiently proficient hack, the hacker will have had access to absolutely everything. They could change anything, and they could take steps to explicitly hide everything they changed.
There’s no way to know they haven’t hidden something you’ll never find. This is one of the reasons rootkits are so dangerous; they modify the system to hide their existence from standard file and folder listings.
Help keep it going by becoming a Patron.
Related
How Do I Remove Malware from Windows?
I'll walk you through the steps to clean an infected computer, from backups and full scans to the one method guaranteed to work... plus how to avoid the whole mess next time.#3811
Traditional solutions
What most people do after a hack is run scans with anti-malware tools or security packages, hoping they’ll catch whatever was corrupted and repair it. Often this means running complete scans with their existing utilities and using additional tools in the hopes they’ll discover more.
Generally, those tools catch a lot; it’s true. But there’s no guarantee they’ll catch everything.
Once you’ve taken the time to run all the tools, perform all the scans, and look in all the places that you learn of to look in, there’s still no way to know that you’ve found everything.1
You know you were hacked.
Yet regardless of the steps you take, you’ll never know you’ve cleaned up from it completely.
Pragmatic solution #1: backup to the rescue
We can’t prove that a computer is free of malware (even if it’s fresh out of the box), but there are steps we can take after a known compromise to improve the odds of having a clean machine.
Related
How to Back Up Windows
Don’t risk losing everything! I’ll show you how to back up Windows step by step, using free tools you already have. Protect your files, photos, and memories so you’re ready when, not if, disaster strikes.#30103
The first approach is to back up your data to capture any recent changes, and then restore your system from a complete (or system-image) backup taken before the hack.
Of course, you can only use this solution if you’ve been creating complete backup images on a regular basis, and if you know when the hack happened. Most people fail the first criterion, sadly. The second can be difficult to determine, but more often than not, there’s a sign or symptom that made the compromise apparent.
Pragmatic solution #2: backup, reformat, reinstall
The second, more painful, approach is to back up your data2, and then:
- Reformat and reinstall Windows from scratch
- Reinstall all your applications from scratch
- Carefully restore your data as you need it
If this feels painful, that’s because it is. It is time-consuming, but it’s often less time-consuming than struggling with a still-infected or unstable machine, and much more reassuring than not knowing if you’ve eliminated the threat.
After you’ve done so, make sure to implement that full system backup strategy to make recovery simpler should you ever get hacked again.
Do this
Don’t underestimate the risk of malware or the difficulty of removing it once it’s arrived. If you’re not already doing so, begin backing up regularly so you can recover more easily should it happen to you.
Just yesterday I reset Microsoft Edge in an attempt to solve a problem with Facebook. Bingo! Malware Pop Ups! Demanding I renew a subscription to a fake McAffee AV and press this or that button to repair my computer. Shut down my computer, disconnected from the internet. Turned on my computer and ran Malware Bytes and Windows Defender (90 minutes plus). No help. So, then I ran Defender in the offline mode. No help. On the internet I found a forum comment that my situation implied malware in my Temporary Files folder. Smart guy as I am I ran CCleaner. Problem solved! CCleaner emptied my Temporary Files folder completely! Have a nice day, Leo!
You don’t need a special tool to empty temporary files. You can just empty the folder yourself, manually. That’s what I do periodically.
I have a shortcut to my Temp folder. I open it and press Ctrl+A to select everything. I press Shift+Delete to actually delete them instead of sending them to the Recycle Bin. Normally, Shift+Delete should be used carefully, as the Recycle Bin gives you a chance to change your mind, but when clearing the Temp folder, any Temp files in use are protected and can’t be deleted.
Hi Leo,
Again, thank you so very much for all your articles, they are very informative and I know you must spend a lot of time putting these together.
Just a quick question, is there really a “FREE” version of EaseUS ? I only see a 30 day versions?
Thanks Again.
Yes there is. They push the trial version hard, but the truly free version is there.
I agree that the simple answer to the question raised in the title is that there’s no way of knowing which files may be affected because once a hacker obtains enough access to implant malware, they can do most anything they want. That’s one reason I use Defender, and I enable Ransomware protection, Smart App Control (Not enabled by default), and Memory Integrity on my Windows installation, because even though there is no such thing as perfect security, these options will at least make an intrusion attempt difficult enough that maybe the intruder will go looking for lower hanging fruit.
There’s also system image backups, which I’m sure you are doing. Not perfect, but backups bring you as close to perfect security as you can get. You can roll your system back to a state it was in before the malware.
Hi Mark,
I ‘m a little confused about the system image backups.
Do I have to do several separate full image backups?
How many?
I don’t understand this process.
Thanks.
Regards.
Chris.
Here are a couple of articles to help you decide what’s best for your needs.
How long should I Keep Backups?
How Do I Schedule Automatic Backups?